PACMAN.CONF(5)

📦
version 7.1.0.r9.g54d9411 · 13 versions
, in arch rolling

💖 PACMAN.CONF 💖

okay bestie, welcome to pacman.conf(5) — that's section 5 of the Pacman Manual, and it's literally the glow-up guide for pacman's config file. grab a snack, this one's a long read but we're doing it together 🫶

✨ NAME ✨

pacman.conf — the pacman package manager configuration file. yep. that's the whole name. iconic.

✨ SYNOPSIS ✨

/etc/pacman.conf

✨ DESCRIPTION ✨

so here's the tea ☕ — Pacman, using libalpm(3), will attempt to read pacman.conf every single time it is invoked. every time. no cap.

This configuration file is split into sections, aka repositories. Each section defines a package repository that pacman can use when it's searching for packages in --sync mode. the one exception to this whole setup? the options section, which defines the global options. she's special like that 💅

Comments are only supported by beginning a line with the hash (#) symbol. Comments cannot begin in the middle of a line. so don't be sneaky and try to tack a comment onto the end of a directive, it will not work, fr fr 😭

✨ EXAMPLE ✨

#
# pacman.conf
#
[options]
NoUpgrade = etc/passwd etc/group etc/shadow
NoUpgrade = etc/fstab

[core]
Include = /etc/pacman.d/core

[custom]
Server = file:///home/pkgs
Note — Every directive must be in CamelCase. If the case isn't respected, the directive won't be recognized. For example, noupgrade or NOUPGRADE will not work. the config file is a little picky, she has standards 💅

✨ OPTIONS ✨

  • RootDir = /path/to/root/dir — Sets the default root directory for pacman to install to. This option is used if you want to install a package on a temporary mounted partition which is "owned" by another system, or for a chroot install.
NOTE: If database path or log file are not specified on either the command line or in pacman.conf(5), their default location will be inside this root path.
  • DBPath = /path/to/db/dir — Overrides the default location of the toplevel database directory. The default is /var/lib/pacman/. Most users will not need to set this option.
NOTE: if specified, this is an absolute path and the root path is not automatically prepended.
  • CacheDir = /path/to/cache/dir — Overrides the default location of the package cache directory. The default is /var/cache/pacman/pkg/. Multiple cache directories can be specified, and they are tried in the order they are listed in the config file. If a file is not found in any cache directory, it will be downloaded to the first cache directory with write access.
NOTE: this is an absolute path, the root path is not automatically prepended.
  • HookDir = /path/to/hook/dir — Adds directories to search for alpm hooks in, on top of the system hook directory (/usr/share/libalpm/hooks/). The default is /etc/pacman.d/hooks. Multiple directories can be specified, with hooks in later directories taking precedence over hooks in earlier directories.
NOTE: this is an absolute path, the root path is not automatically prepended. For more info on the alpm hooks, see alpm-hooks(5).
  • GPGDir = /path/to/gpg/dir — Overrides the default location of the directory containing configuration files for GnuPG. The default is /etc/pacman.d/gnupg/. This directory should contain two files: pubring.gpg and trustdb.gpg. pubring.gpg holds the public keys of all packagers. trustdb.gpg contains a so-called trust database, which specifies that the keys are authentic and trusted.
NOTE: this is an absolute path, the root path is not automatically prepended.
  • LogFile = /path/to/log/file — Overrides the default location of the pacman log file. The default is /var/log/pacman.log. This is an absolute path and the root directory is not prepended.
  • HoldPkg = package ... — If a user tries to --remove a package that's listed in HoldPkg, pacman will ask for confirmation before proceeding. Shell-style glob patterns are allowed.
  • IgnorePkg = package ... — Tells pacman to ignore any upgrades for this package when performing a --sysupgrade. Shell-style glob patterns are allowed.
  • IgnoreGroup = group ... — Tells pacman to ignore any upgrades for all packages in this group when performing a --sysupgrade. Shell-style glob patterns are allowed.
  • Include = /path/to/config/file — Include another configuration file. This file can include repositories or general configuration options. Wildcards in the specified paths will get expanded based on glob(7) rules.
  • Architecture = auto &| i686 &| x86_64 | ... — If set, pacman will only allow installation of packages with the given architectures (e.g. i686, x86_64, etc). The special value auto will use the system architecture, provided via "uname -m". If unset, no architecture checks are made.
NOTE: Packages with the special architecture any can always be installed, as they are meant to be architecture independent.
  • XferCommand = /path/to/command %u [%o] — If set, an external program will be used to download all remote files. All instances of %u will be replaced with the download URL. If present, instances of %o will be replaced with the local filename, plus a ".part" extension, which allows programs like wget to do file resumes properly.

This option is useful for users who experience problems with built-in HTTP/FTP support, or need the more advanced proxy support that comes with utilities like wget.

  • NoUpgrade = file ... — All files listed with a NoUpgrade directive will never be touched during a package install/upgrade, and the new files will be installed with a .pacnew extension. These files refer to files in the package archive, so do not include the leading slash (the RootDir) when specifying them. Shell-style glob patterns are allowed. It is possible to invert matches by prepending a file with an exclamation mark. Inverted files will result in previously blacklisted files being whitelisted again. Subsequent matches will override previous ones. A leading literal exclamation mark or backslash needs to be escaped.
  • NoExtract = file ... — All files listed with a NoExtract directive will never be extracted from a package into the filesystem. This can be useful when you don't want part of a package to be installed. For example, if your httpd root uses an index.php, then you would not want the index.html file to be extracted from the apache package. These files refer to files in the package archive, so do not include the leading slash (the RootDir) when specifying them. Shell-style glob patterns are allowed. It is possible to invert matches by prepending a file with an exclamation mark. Inverted files will result in previously blacklisted files being whitelisted again. Subsequent matches will override previous ones. A leading literal exclamation mark or backslash needs to be escaped.
  • CleanMethod = KeepInstalled &| KeepCurrent — If set to KeepInstalled (the default), the -Sc operation will clean packages that are no longer installed (not present in the local database). If set to KeepCurrent, -Sc will clean outdated packages (not present in any sync database). The second behavior is useful when the package cache is shared among multiple machines, where the local databases are usually different, but the sync databases in use could be the same. If both values are specified, packages are only cleaned if not installed locally and not present in any known sync database.
  • SigLevel = ... — Sets the default signature verification level. For more info, see Package and Database Signature Checking below.
  • LocalFileSigLevel = ... — Sets the signature verification level for installing packages using the -U operation on a local file. Uses the value from SigLevel as the default.
  • RemoteFileSigLevel = ... — Sets the signature verification level for installing packages using the -U operation on a remote file URL. Uses the value from SigLevel as the default.
  • UseSyslog — Log action messages through syslog(). This will insert log entries into /var/log/messages or equivalent.
  • Color — Automatically enable colors only when pacman's output is on a tty. she knows when to show off 💅
  • NoProgressBar — Disables progress bars. This is useful for terminals which do not support escape characters.
  • CheckSpace — Performs an approximate check for adequate available disk space before installing packages.
  • VerbosePkgLists — Displays name, version and size of target packages formatted as a table for upgrade, sync and remove operations.
  • DisableDownloadTimeout — Disable defaults for low speed limit and timeout on downloads. Use this if you have issues downloading files with proxy and/or security gateway.
  • ParallelDownloads = ... — Specifies number of concurrent download streams. The value needs to be a positive integer. If this config option is not set then only one download stream is used (i.e. downloads happen sequentially). no multitasking energy, just one at a time 😭
  • DownloadUser = username — Specifies the user to switch to for downloading files. If this config option is not set then the downloads are done as the user running pacman.
  • DisableSandbox — Completely disables the sandbox applied to the process of downloading files on Linux systems. Equivalent to jointly specifying DisableSandboxFilesystem and DisableSandboxSyscalls.
  • DisableSandboxFilesystem — Disable the filesystem restrictions part of the sandbox applied to the process downloading files on Linux systems. Useful if experiencing Landlock related failures while downloading files when running a Linux kernel that does not support this feature.
  • DisableSandboxSyscalls — Disable the syscall filtering part of the sandbox applied to the process downloading files on Linux systems. Useful if experiencing seccomp related failures while downloading files when running a Linux kernel that does not support this feature.

🌸 REPOSITORY SECTIONS 🌸

okay bestie so every repository section is like its own lil group chat: it needs a section name and at least one place where the packages can actually be found. The section name is whatever string sits inside the square brackets (the two we showed you up above are core and custom). Repo names have to be unique, and heads up — the name local is reserved for the database of installed packages, so don't even try it 💅. The locations get defined with the Server directive and they follow a URL naming structure. Wanna use a plain local directory? Totally fine — just give the full path with a file:// prefix, exactly like we did above. ✨

The most common way to define DB locations uses the Include directive. For each repository you define in the config file, one single Include directive can point at a file that lists the servers for that repository. it's giving organized:

[core]
# use this server first
Server = ftp://ftp.archlinux.org/$repo/os/$arch
# next use servers as defined in the mirrorlist below
Include = /etc/pacman.d/mirrorlist

and the order matters, no cap — repositories listed first take precedence over the ones listed later in the file when packages in two repositories have identical names, regardless of version number. first come, first served, periodt.

  • Include = path — pulls in another config file. That file can include repositories or general configuration options. Any wildcards in the specified paths get expanded based on glob(7) rules. cute and powerful 🦋
  • CacheServer = url — a full URL to a location where the packages, and signatures (if available) for this repository can be found. Cache servers get tried before any non-cache servers, they will not be removed from the server pool for 404 download errors, and they will not be used for database files. iconic behavior honestly
  • Server = url — a full URL to a location where the database, packages, and signatures (if available) for this repository can be found.

During parsing, pacman defines the $repo variable to the name of the current section. This is often utilized in files specified using the Include directive so all repositories can use the same mirrorfile. pacman also defines the $arch variable to the first (or only) value of the Architecture option, so the same mirrorfile can even be used for different architectures. one file, many vibes 💖

  • SigLevel = ... — sets the signature verification level for this repository. For more info, see Package and Database Signature Checking below 👇
  • Usage = ... — sets the usage level for this repository. This option takes a list of tokens, and it has to be at least one of these:
    • Sync — enables refreshes for this repository.
    • Search — enables searching for this repository.
    • Install — enables installation of packages from this repository during a --sync operation.
    • Upgrade — allows this repository to be a valid source of packages when performing a --sysupgrade.
    • All — enables all of the above features for the repository. This is the default if not specified.
Note that an enabled repository can be operated on explicitly, regardless of the Usage level set. she does what she wants 💅

🔐 PACKAGE AND DATABASE SIGNATURE CHECKING 🔐

The SigLevel directive is valid in both the [options] and repository sections. If you use it in [options], it sets a default value for any repository that doesn't provide the setting. like a group default, iykyk.

  • If set to Never, no signature checking will take place.
  • If set to Optional , signatures will be checked when present, but unsigned databases and packages will also be accepted.
  • If set to Required, signatures will be required on all packages and databases.

Alternatively, you can get more fine-grained control by combining some of the options and prefixes described below. All options in a config file are processed in top-to-bottom, left-to-right fashion, where later options override and/or supplement earlier ones. If SigLevel is specified in a repository section, the starting value is that from the [options] section, or the built-in system default as shown below if not specified. layers on layers, fr fr 🧚

The options are split into two main groups, described below. Terms used such as “marginally trusted” are terms used by GnuPG, for more information please consult gpg(1). 💜

When to Check

These options control if and when signature checks should take place.

  • Never — all signature checking is suppressed, even if signatures are present. not me looking away 🙈
  • Optional — signatures are checked if present; absence of a signature is not an error. An invalid signature is a fatal error, as is a signature from a key not in the keyring.
  • Required (default) — signatures are required; absence of a signature or an invalid signature is a fatal error, as is a signature from a key not in the keyring. strict queen 👑

What is Allowed

These options control what signatures are viewed as permissible. Note that neither of these options allows acceptance of invalid or expired signatures, or those from revoked keys. nope, absolutely not 🚫

  • TrustedOnly (default) — if a signature is checked, it must be in the keyring and fully trusted; marginal trust does not meet this criteria.
  • TrustAll — if a signature is checked, it must be in the keyring, but is not required to be assigned a trust level (e.g., unknown or marginal trust).

Options in both groups can additionally be prefixed with either Package or Database, which will cause it to only take effect on the specified object type. For example, PackageTrustAll would allow marginal and unknown trust level signatures for packages. mixing and matching, main character energy ✨

The built-in default is the following:

SigLevel = Required TrustedOnly

🎀 USING YOUR OWN REPOSITORY 🎀

If you have numerous custom packages of your own, it is often easier to generate your own custom local repository than install them all with the --upgrade option. All you need to do is generate a compressed package database in the directory with these packages so pacman can find it when run with --refresh. look at you, DIY icon:

repo-add /home/pkgs/custom.db.tar.gz /home/pkgs/*.pkg.tar.gz

The above command will generate a compressed database named /home/pkgs/custom.db.tar.gz. Note that the database must be of the form defined in the configuration file and {ext} is a valid compression type as documented in repo-add(8). That’s it! 🎉 Now configure your custom section in the configuration file as shown in the config example above. Pacman will now use your package repository. If you add new packages to the repository, remember to re-generate the database and use pacman’s --refresh option. don't forget or she'll be confused 😭

For more information on the repo-add command, see “repo-add --help” or repo-add(8).

🌈 SEE ALSO 🌈

pacman(8), libalpm(3)

See the pacman website at https://archlinux.org/pacman/ for current information on pacman and its related tools.

💀 BUGS 💀

Bugs? You must be kidding; there are no bugs in this software. 😌✨ But if we happen to be wrong, please report them to the issue tracker at https://gitlab.archlinux.org/pacman/pacman/-/issues with specific information such as your command-line, the nature of the bug, and even the package database if it helps. receipts, bestie — we need receipts 🫶

👑 AUTHORS 👑

Current maintainers:

  • Allan McRae <allan@archlinux.org>
  • Andrew Gregory <andrew.gregory.8@gmail.com>
  • Morgan Adamiec <morganamilo@archlinux.org>

Past major contributors:

  • Judd Vinet <jvinet@zeroflux.org>
  • Aurelien Foret <aurelien@archlinux.org>
  • Aaron Griffin <aaron@archlinux.org>
  • Dan McGee <dan@archlinux.org>
  • Xavier Chantry <shiningxc@gmail.com>
  • Nagy Gabor <ngaba@bibl.u-szeged.hu>
  • Dave Reisner <dreisner@archlinux.org>
  • Eli Schwartz <eschwartz@archlinux.org>

For additional contributors, use git shortlog -s on the pacman.git repository.

and that's the whole page bestie, you ate it UP 💅✨ this was Pacman 7.1.0, dated 2026-10-15, and it's the PACMAN.CONF(5) manual — go configure something iconic, mwah 💖🦋🌸

📦 where this page comes from